HSTS done right: enforce HTTPS without breaking subdomains

What HSTS solves

Strict-Transport-Security tells browsers to use HTTPS for your domain for a fixed duration. This prevents protocol downgrade attacks and protects returning visitors from accidental HTTP links.

Without HSTS, a user can still be exposed on the first HTTP request if an attacker can interfere with network traffic. HSTS narrows that risk by making HTTPS sticky in the browser.

Recommended production policy

For production websites, use at least one year of max-age once your HTTPS setup is stable. Add includeSubDomains only after confirming every subdomain supports HTTPS.

Implementation checklist

• Start with max-age=86400 in staging and verify redirects/certificates.
• Move to max-age=31536000 when confident.
• Add includeSubDomains when all active subdomains are HTTPS-ready.
• Consider preload only after long-term validation.

Example header

Strict-Transport-Security: max-age=31536000; includeSubDomains

Common rollout mistakes

The most common issue is enabling includeSubDomains too early. Legacy or forgotten subdomains then become unavailable to users because browsers refuse HTTP fallback.

Another mistake is adding preload before operational readiness. Preload list removal is slow and can take time to propagate to users.